There aren't good tech resources because GDPR isn't tech driven. You have to start from a legal standpoint. The tech will present itself from there, highly depe

There aren't good tech resources because GDPR isn't tech driven. You have to start from a legal standpoint. The tech will present itself from there, highly dependent on your architecture. There are of course some basic things you can do without understanding the legal, like how to store PII. The example questions you have are poor. The first one depends on your infra, entirely. The second on depends on a) details you haven't supplied and b) legal structure around the data itself. You need a consultant.